Bestavros, Azer

Lapets, Andrei

Varia, Mayank

Communications of the ACM

English

Boston University Institutional Repository (OpenBU)

Boston UniversityOpenBU http://open.bu.eduBU Open Access Articles BU Open Access Articles2017-02-01User-centric distributed solutionsfor privacy-preserving analyticsThis work was made openly accessible by BU Faculty. Please share how this access benefits you.Your story matters.VersionCitation (published version): Azer Bestavros, Andrei Lapets, Mayank Varia. 2017. "User-CentricDistributed Solutions for Privacy-Preserving Analytics."COMMUNICATIONS OF THE ACM, Volume 60, Issue 2, pp. 37 - 39 (3).https://hdl.handle.net/2144/26109Boston UniversityUser-centric Distributed Solutions for Privacy-preserving AnalyticsHow can cryptography empower users with sensitive data to accesslarge-scale computing platforms in a privacy-preserving manner?Azer Bestavros, Andrei Lapets, and Mayank Varia (Boston University)For over a year, a high-profile initiative spear-headed by the City of Boston and the BostonWomen’s Workforce Council (BWWC) strivedto identify salary inequities across various em-ployee gender and ethnic demographics at dif-ferent levels of employment, from executive toentry-level positions [1]. While the effort wassupported by a diverse set of more than 100employer organizations in the city — includ-ing major corporations, small businesses, andpublic/non-profit organizations — it was stalledby concerns about the confidentiality of the datato be collected in order to calculate aggregatemetrics [5].A key enabling technology that allowed thiseffort to move forward was a web-based applica-tion (which can be seen at 100talent.org) thatwe designed and implemented at Boston Uni-versity to support the aggregation of sensitivesalary data using secure multi-party computa-tion (MPC) [10]. This application was used in afirst-of-its-kind collaborative effort to computeaggregate payroll analytics without revealing theindividual data sets of contributing organizations.This deployment of MPC, which received signifi-cant media attention [3,5], finally enabled theBWWC to conduct their analysis.MPC privately shards users’ sensitive dataacross multiple servers in such a way that analyt-ics may be jointly computed and released whileensuring that (small collections of) servers can-not learn any user’s data. Theoretical constructsfor MPC have been known for 35 years, withseveral existing software frameworks designedover the past 10 years [9,11].MPC techniques can possess substantial so-cial value: they enable society to benefit fromcollective data aggregation and analysis in con-texts where the raw data are encumbered bylegal and corporate policy restrictions on datasharing. Other examples of deploying MPC forsocial good include tax fraud detection [6] anddisease surveillance [7]. Additionally, becauseMPC decouples computing and networking re-sources from data, users can leverage the bene-fits of large data centers without ceding controlover their sensitive data.However, MPC’s social benefits cannot berealized unless we empower participating orga-nizations (i.e., their executives, directors, and le-gal advisors) with a clear, confident understand-ing of exactly how MPC protects their sensitivedata and mathematically guarantees compliancewith data sharing restrictions. The design andimplementation of our own unique MPC plat-form was informed by nearly two years’ worthof discussions with non-technical personnel (in-cluding CIOs, CTOs, HR executives, and lawyersfrom key participating organizations), social sci-entists, and members of the city council thatcommissioned the study [2]. These discussionshad to take place in meetings and teleconfer-ences where the only aids were whiteboards andslideshows; they involved both describing secretsharing in a concrete, hands-on way as well asproviding details of the implementation and howit realized the capabilities and guarantees of thistechnique. Ultimately, these exchanges werenecessary to demystify MPC for decision makersand, more generally, to help us understand andmitigate what we have come to realize are thehurdles that face real-world MPC deployments.The systems community has grappled re-cently with the realization that its significant1body of work on scalable platforms did not ad-equately consider the question of what mini-mum distributed computing configuration out-performs a single thread (COST) [12]. Analo-gously, in this article we argue that the exten-sive body of MPC research to date has not ade-quately considered the needs and circumstancesof the ultimate users of MPC. Our own experi-ence echoes and confirms thoughts expressed byother researchers in the community [15]: ”Se-cure computation is a general scheme; in realityone has to choose an application, starting froma very real business need, and build the solutionfrom the problem itself choosing the right tools,tuning protocol ideas into a reasonable solution,balancing security and privacy needs vs. otherconstraints: legal, system setting, etc.” We drawfrom our experience to advocate for the designof platforms that address concerns along Usabil-ity, Scalability, Entrustment, and Risk (USER)dimensions.UsabilityTo meet the needs of our users, we rejected themost algorithmically expressive MPC solutionsavailable in the literature [9]. Instead, we foundthat what we needed was the simplest of proto-cols: just expressive enough for the applicationat hand while being comprehensible enough tofuel adoption among corporate officers, legalrepresentatives, and rank and file employees.We also found that participants’ software plat-form and IT infrastructure inflexibilities and lim-itations (legacy systems, restrictive policies, fire-walls, and so on) required the most lightweightsolution: a simple browser-based applicationthat could accommodate the familiar look andfeel of a spreadsheet, with transparent open-source code to enable outside auditing. Finally,our MPC protocol needed to accept contributors’data asynchronously to simplify coordination andidempotently to allow contributors to fix errors.Usable MPC is an enabling technology withsubstantial potential for social good, but onlyif enough participants are willing to contributetoward the analysis. In the pay equity scenario,the usability of both the protocol and its im-plementation helped decision-makers – afteronly a few conversations – gain confidence intheir understanding of the technology, appre-ciate that it would impose no significant bur-dens on their staff and infrastructure, and as-sured that features such as idempotence andasynchrony would make deployment logisticallyfeasible and likely to produce meaningful results.This, in turn, increased the willingness of partic-ipants to contribute their sensitive data.Usability also extends to the specification ofpolicies governing proper uses of data. ExistingMPC frameworks neglect to address privacy poli-cies, in part because the policy may not be ex-pressible by either the original data contributor(who may lack expertise in privacy-related mat-ters) or the analyst (who doesn’t know the users’preferences or other uses of the data). Existingtechniques from the programming languages re-search and formal methods communities suchas policy-agnostic programming (in which thepolicies that govern inputs are specified inde-pendently from the data flows and logic of thealgorithm), as well as static analysis (to automat-ically derive policies from algorithms and com-pare them to user-specified policies) can play asignificant role in validating whether an analyticis compatible with a specified privacy policy.ScalabilityTypically, MPC frameworks are evaluated basedon their computational efficiency for simple an-alytics over relatively small datasets. This is asituation in which all modern frameworks per-form rather well (i.e., seconds to minutes) [4].However, human time dominates computingtime in scenarios involving small-scale data suchas the pay equity effort, in which a window span-ning multiple days may be required to collectsalary data from a large number of contributorsoperating according to incompatible schedules,rendering the computing time negligible by com-parison. In this case, MPC frameworks should2prioritize software development and IT infras-tructure design over the speed of computingthe analytic. At the other extreme, when aggre-gating large-scale datasets, an MPC frameworkshould optimize the computation that can beperformed locally so as to minimize the costsincurred due to MPC.To resolve both challenges, we have inte-grated existing MPC frameworks into the Mus-keteer big data workflow manager [8]. Whereasprior MPC frameworks require that software en-gineers design analytics in a domain-specific lan-guage, we permit rapid development in the well-known SQL and MapReduce paradigms, withautomated generation of code to execute inexisting back-end distributed frameworks likeHadoop, Spark, or Naiad so that developers andadministrators can “focus on the what ratherthan the how of security” [13]. Additionally,our framework automatically infers when sen-sitive data crosses trust boundaries in order tominimize usage of MPC. We tested this systemto compute a market concentration metric over160 GB of public NYC taxi trips’ fare informationwith just 8.3% overhead over the correspondinginsecure computation [14].EntrustmentAt its heart, MPC permits federation of trustamong several computing entities such that eachuser only needs to trust that any one of them(or a small fraction) is honest. Most existingMPC research papers and software frameworksenvision homogeneous entities. By contrast, wedesign a more flexible MPC framework that al-lows contributors to entrust entities with differ-ent responsibilities.Along these lines, we provide a taxonomyof roles for entities that participate in MPC: alarge, potentially a priori unknown number ofcontributors with private data; an analyzer whospecifies an analytic; a publicly accessible ser-vice provider who collects encoded data from thecontributors without requiring them to be onlinesimultaneously and who also participates in thedistributed computation; additional servers whoparticipate in the distributed computation; oneor more repositories that host the secure comput-ing software; and the recipients of the analysis.Behind the scenes, there may also be privacy ex-perts and software engineers who assemble oneor more of the components in this ecosystem. Inpractice, parties using MPC may take on severalof these roles simultaneously.1 MPC provides therecipients with the results of the analytic overthe contributors’ data, and it provably guaran-tees that nobody learns anything else.Just as each entity has different assignments,so too might they have different levels of trustin one another. For brevity, we focus here on theservice provider, who must connect to all otherentities and may require immense computingpower. When both of these characteristics si-multaneously apply, the service provider (1) hasa large attack surface and (2) is well-suited tobeing run within a cloud computing datacenter.Our pay equity software enables the mostpowerful computing entity also to be the leasttrusted. Our service provider runs on AmazonWeb Services to collect and store encoded data;however, contributors can choose instead to en-trust the BWWC to protect the confidentiality oftheir data. We envision a future in which cloudproviders offer ‘secure computing-as-a-service’deployments of MPC that decouple control overdata from computing power.RiskMPC research studies four types of adversaries:semi-honest entities who execute software asprovided but may attempt to glean informationalong the way, covert adversaries who cheat onlyif they’re unlikely to be caught, rational adver-saries who cheat as long as the expected payoutis larger than the expected penalty if caught,and fully malicious entities who perform any ac-1Some readers may be familiar with a related technology: fully homomorphic encryption (FHE). Abstractly, FHE canbe viewed as a specialization of MPC to the 2-party outsourcing setting in which the contributor, analyzer, and recipientare the same party and in which the service provider’s computation doesn’t require interaction [4,9].3tion necessary to breach the confidentiality orintegrity of honest users.We advocate for the MPC community tomatch cryptographic models of adversarial be-havior with the economic (e.g., reputation-based)and legal incentives that real-world users face.A more accurate and fine-grained characteriza-tion of risks can result in a faster, simpler MPCprotocol that satisfies users’ needs. Our pay eq-uity project exposed delicate economic and legalconcerns whose impact upon risk models shouldbe explored further.First, the existing risk models fail to capturethe subtlety of reputation-based economic incen-tives. In the pay equity scenario, the analyzerand repository have the capacity to alter the soft-ware to leak secrets; however, they should notexecute this capability due to the long-term dam-age to their reputation and economic viability.Analogously to the differences between the one-shot and iterated prisoner’s dilemma games, therational model of MPC provides an incompleteview because it focuses on a single execution.Second, MPC has a complex interconnectionwith the law. In our pay equity scenario, evenif the BWWC could somehow learn the contrib-utors’ data by cheating, it has a strong legal in-centive not to acquire this data because it couldthen be exposed to lawsuits. Indeed, one of themajor hurdles that faced BWWC prior to theiruse of our solution was the unwillingness of anysingle entity (including a major local university,originally enlisted to perform the study) to as-sume the liability in case of leakage or loss ofdata entrusted to them. Moreover, followingMPC honestly may provide BWWC legal protec-tions afforded by following best practices or byrestricting data sharing. Hence, the BWWC hasa strong legal incentive to act in a semi-honestmanner. Conversely, appropriately-written legalcontracts can enshrine MPC’s constraints (e.g.,operating in the best interest of another entity,or forbidding collusion between entities) withenforceable civil penalties. We propose a greaterexamination of the implications of the law uponMPC and vice-versa.ConclusionWe are convinced that the empowering and en-abling aspects of MPC will make substantialcontributions to data-driven analysis and policy-making by enabling individuals and organiza-tions at all levels to derive insights about theircollective data without requiring that they sharethat data, but only if the technology is accessibleboth conceptually and technologically to a broadaudience. In this article, we proposed a four-pronged research agenda to make MPC moreusable along a variety of dimensions, increase itsscalability for humans and computers alike, as-sign responsibilities that align with existing trustrelationships, and systematically understand thelegal and economic risks when trust is violated.These recommendations are informed by ourprior work deploying MPC to aggregate wagedata and compute pay equity metrics — workthat is, in the words of BWWC co-chair EvelynMurphy, “beginning to show how to use sophisti-cated computer science research for public pro-grams” [3].AcknowledgmentsThis material is based upon work supported bythe National Science Foundation under GrantsNo. 1414119 and 1430145.References[1] 100% Talent: The Boston Women’s Compact.http://www.cityofboston.gov/women/workforce/compact.asp. [Accessed: October 30,2016].[2] Signers of 100% Talent: The Boston Women’sCompact.http://www.bostonwomensworkforcecouncil.com/corporate-signatories/. [Accessed:October 30, 2016].[3] Will Data Help Close The Gender Pay Gap?http://www.wbur.org/onpoint/2016/03/30/gender-gap-pay-gap-boston-amazon. [Accessed:October 30, 2016].[4] David W. Archer, Dan Bogdanov, Benny Pinkas, andPille Pullonen. Maturity and Performance ofProgrammable Secure Computation. IACRCryptology ePrint Archive, 2015(1039).[5] Rich Barlow. Computational Thinking Breaks aLogjam: Hariri Institute helps address Boston’smale-female pay gap. BU Today.4[6] Dan Bogdanov, Marko Jo˜emets, Sander Siim, andMeril Vaht. How the Estonian Tax and Customs BoardEvaluated a Tax Fraud Detection System Based onSecure Multi-party Computation, pages 227–234.Springer Berlin Heidelberg, Berlin, Heidelberg,2015.[7] Khaled El Emam, Jun Hu, Jay Mercer, Liam Peyton,Murat Kantarcioglu, Bradley Malin, DavidBuckeridge, Saeed Samet, and Craig Earle. A secureprotocol for protecting the identity of providerswhen disclosing data for disease surveillance.Journal of the American Medical InformaticsAssociation : JAMIA, 18(3):212—217, May 2011.[8] Ionel Gog, Malte Schwarzkopf, Natacha Crooks,Matthew P. Grosvenor, Allen Clement, and StevenHand. Musketeer: all for one, one for all in dataprocessing systems. In Proceedings of the TenthEuropean Conference on Computer Systems (EuroSys),pages 2:1–2:16, 2015.[9] Ariel Hamlin, Nabil Schear, Emily Shen, MayankVaria, Sophia Yakoubov, and Arkady Yerukhimovich.Cryptography for Big Data Security. In Fei Hu, editor,Chapter in Big Data: Storage, Sharing, and Security.CRC Press, May 2016.[10] Andrei Lapets, Nikolaj Volgushev, Azer Bestavros,Frederick Jansen, and Mayank Varia. SecureMulti-Party Computation for Analytics Deployed as aLightweight Web Application. Technical ReportBUCS-TR-2016-008, CS Dept., Boston University,July 2016.[11] Yehuda Lindell and Benny Pinkas. Secure MultipartyComputation for Privacy-Preserving Data Mining.The Journal of Privacy and Confidentiality,1(1):59–98, 2009.[12] Frank McSherry, Michael Isard, and Derek G. Murray.Scalability! But at what COST? In 15th Workshop onHot Topics in Operating Systems (HotOS XV),Kartause Ittingen, Switzerland, May 2015. USENIXAssociation.[13] Emily Shen, Mayank Varia, Robert K. Cunningham,and W. Konrad Vesey. Cryptographically SecureComputation. IEEE Computer, 48(4):78–81, 2015.[14] Nikolaj Volgushev, Malte Schwarzkopf, AndreiLapets, Mayank Varia, and Azer Bestavros. DEMO:Integrating MPC in Big Data Workflows. InProceedings of CCS 2016: The 23rd ACM SIGSACConference on Computer and CommunicationsSecurity, 2016.[15] Moti Yung. From mental poker to core business:Why and how to deploy secure computationprotocols? In Proceedings of the 22Nd ACM SIGSACConference on Computer and CommunicationsSecurity, CCS ’15, pages 1–2, New York, NY, USA,2015. ACM.5

User-centric distributed solutions for privacy-preserving analytics

https://open.bu.edu/bitstream/2144/26109/3/cacm-s-p.pdf

User-centric distributed solutions for privacy-preserving analytics

Abstract

Similar works

Full text

Available Versions

Boston University Institutional Repository (OpenBU)